---
schema_version: "1"
id: 12c9573857751556a2cbef071c8d5589c85b6ce7810de6e911eefae9495ce7ae
title: A2A Token Based Rate Limit Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-a2a-token-rate-limit.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-a2a-token-rate-limit
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 25377118699af28cf1085935c431eb950c596654c7c2277e2917115d7320899b
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: api gateway, flex gateway, gateway, policy, rate limiting, token, a2a
---

# A2A Token Based Rate Limit Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>A2A Token Based Rate Limit</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Rate limits agent usage of upstream resources</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>A2A</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.11.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/a2a-token-rate-limit-release-notes">A2A Token Based Rate Limit</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>429 - Too Many Requests: Token limit exceeded, requests are blocked until the current window finishes</p></td></tr></tbody></table>

> [!NOTE] This policy supports Agent2Agent Protocol (A2A) version v0.3.0. To learn more about A2A
> versions, see [A2A Releases](https://github.com/a2aproject/A2A/releases).

## Summary

The A2A Token Based Rate Limit policy enforces rate limiting on agent requests based on the number
of tokens consumed by the agents. The A2A Token Based Rate Limit policy counts tokens using the
GPT-4o-mini tokenizer model, providing control over API usage based on the content being processed.

The policy counts tokens from both request and response payloads. Tokens generated by the response
are counted toward the rate limit of the next request to ensure total token consumption across the
conversation is properly tracked.

If a request exceeds the allowed token limit, the policy blocks the call and returns a `429` status
code.

## Configuring Policy Parameters

### Omni Gateway Local Mode

The A2A Token Based Rate Limit policy isn’t supported in Local Mode.

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Maximum Tokens</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Maximum number of tokens allowed within the specified time period. Must be a positive integer of one or greater.</p></div></div></td></tr><tr><td><div><div><p>Time Period (ms)</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Time period in milliseconds for the rate limit window. Minimum time period is 1000 milliseconds.</p></div></div></td></tr><tr><td><div><div><p>Key Selector</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>DataWeave expression that selects the key for rate limiting. This creates independent rate limit counters for each unique value resolved by the expression. For example:</p></div><div><ul><li><p><code>#[attributes.headers['ClientId']]</code>: Rate limit per client ID</p></li><li><p><code>#[attributes.principal]</code>: Rate limit per user</p></li><li><p><code>#[attributes.headers['X-Forwarded-For']]</code>: Rate limit per IP address</p></li><li><p><code>#[attributes.requestPath]</code>: Rate limit per API path</p></li></ul></div></div></td></tr></tbody></table>

## How This Policy Works

The A2A Token Based Rate Limit policy monitors token consumption in the current window, allowing
requests to reach the backend only if the available token quota is greater than zero.

The policy uses a fixed-window rate limiting algorithm. The window starts after it receives the
first request. When the quota is exhausted, requests are rejected with a 429 status code until the
time window resets.

The `keySelector` parameter enables you to create independent rate limit counters for different
groups of requests. Each unique value resolved by the DataWeave expression has its own token quota
and time window. For example, if you configure `keySelector: "#[attributes.headers['ClientId']]"`
with a limit of 100 tokens per 5 seconds, each individual client has its own 100-token quota in a
5-second window. If you don’t configure a key selector, all requests are counted together.

### Token Counting

The policy uses the GPT-4o-mini tokenizer model to count tokens in:

- **Request payloads**: Tokens are counted from the `params.message.parts` array in JSON-RPC
  requests. The policy extracts text from parts with `kind: "text"` or `type: "text"`, and data from
  parts with `kind: "data"` or `type: "data"`.

- **Response payloads**: Tokens are counted from response content including:

  - Direct message parts in `result.parts`

  - Status message parts in `result.status.message.parts`

  - Artifact parts in `result.artifacts[*].parts`

  - Server-Sent Events (SSE) stream data

To learn more about the GPT-4o-mini tokenizer model, see
[OpenAI Platform Tokenizer](https://platform.openai.com/tokenizer).

### Response Headers

When a request is processed, the policy adds the following headers to the response:

- `x-token-limit`: The maximum number of tokens allowed per window

- `x-token-remaining`: The number of tokens remaining in the current window

- `x-token-reset`: The remaining time, in milliseconds, until a new window starts